CVE-2026-13329 is an improper access control vulnerability (CWE-284) in the Buckaroo Woocommerce Payments Plugin for WordPress. Versions prior to 4.9.0 do not verify user capabilities or validate nonces on an AJAX action responsible for processing payment capture refunds. As a result, any authenticated user, regardless of their role, can invoke this action and trigger refunds against captured orders. This vulnerability could lead to unauthorized financial transactions initiated by low-privileged users.

The vulnerability allows unauthorized refund actions by any authenticated user, including those with Subscriber-level privileges. This can lead to financial loss or disruption of payment processing integrity, as attackers can refund payments without proper authorization. There is no impact on confidentiality or availability reported. The CVSS score of 6.5 reflects a medium severity with high impact on integrity but no impact on confidentiality or availability.

No official fix or patch has been confirmed as of the published date. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles and permissions carefully, and monitor for unusual refund activity. Applying the plugin update to version 4.9.0 or later, once available, is recommended to remediate this issue.